Back
CVE-2011-1751
The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable…
High7.4EPSS 0.74%
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | High7.4 | AV:A/AC:M/Au:S/C:C/I:C/A:C |
- EPSS (exploitation in 30 days)
- 0.74% · top 45% of all CVEs (3 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.
Weakness
Affected products
n/a
- affected n/a
References (18)
- [oss-security] 20110519 CVE-2011-1751 qemu: acpi_piix4: missing hotplug check during device removal (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- RHSA-2011:0534 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=505597e4476a6bc219d0ec1362b760d71cb4fdca (opens in a new tab)x_refsource_CONFIRMx_transferred
- 44648 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 73395 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 44393 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 44658 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- SUSE-SU-2011:0533 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- [Qemu-devel] 20110519 [PATCH] Ignore pci unplug requests for unpluggable devices (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- 47927 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://github.com/nelhage/virtunoid (opens in a new tab)x_refsource_MISCx_transferred
- https://bugzilla.redhat.com/show_bug.cgi?id=699773 (opens in a new tab)x_refsource_MISCx_transferred
- 44458 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 44660 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- http://blog.nelhage.com/2011/08/breaking-out-of-kvm/ (opens in a new tab)x_refsource_MISCx_transferred
- USN-1145-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
- 44900 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- openSUSE-SU-2011:0510 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2011-1751)Record last updated .